CVE-2025-7300
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code by tricking users into opening malicious DWG files with IrfanView's CADImage plugin. The memory corruption flaw occurs during DWG file parsing due to insufficient input validation. Users of IrfanView with the vulnerable CADImage plugin are affected.
💻 Affected Systems
- IrfanView CADImage Plugin
📦 What is this software?
Cadimage by Cadsofttools
Cadimage by Cadsofttools
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining the same privileges as the user running IrfanView, potentially leading to data theft, ransomware deployment, or lateral movement.
Likely Case
Malware installation or data exfiltration when users open malicious DWG files from untrusted sources.
If Mitigated
Limited impact with proper application sandboxing and user awareness preventing malicious file execution.
🎯 Exploit Status
Exploitation requires user interaction to open malicious DWG file. No public exploit code available at this time.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check IrfanView website for latest CADImage plugin update
Vendor Advisory: https://www.irfanview.com/
Restart Required: No
Instructions:
1. Visit https://www.irfanview.com/
2. Download latest IrfanView version
3. Install updated CADImage plugin
4. Verify plugin version is patched
🔧 Temporary Workarounds
Disable CADImage Plugin
windowsRemove or disable the vulnerable CADImage plugin from IrfanView
Navigate to IrfanView plugins folder and remove CADImage.dll
File Association Removal
windowsRemove DWG file association with IrfanView
Control Panel > Default Programs > Set Associations > Remove .dwg from IrfanView
🧯 If You Can't Patch
- Implement application whitelisting to block IrfanView execution
- Use email/web filtering to block DWG attachments from untrusted sources
🔍 How to Verify
Check if Vulnerable:
Check IrfanView Help > About Plugins for CADImage plugin versionCheck Version:
irfanview.exe /pluginsVerify Fix Applied:
Verify CADImage plugin version matches latest patched version from vendor📡 Detection & Monitoring
Log Indicators:
- IrfanView process spawning unexpected child processes
- Multiple DWG file open attempts from same source
Network Indicators:
- Outbound connections from IrfanView process to unknown IPs
SIEM Query:
process_name:"i_view32.exe" AND (file_extension:".dwg" OR parent_process:explorer.exe)